@netlify/spark-ui 1.30.0 → 1.31.0-alpha.2

package/packages/components/preact/DropZone/drop-core/authedDropClient.ts

@@ -0,0 +1,185 @@
+import { apiError, type DropClient } from './client';
+import type { BuildSite } from './buildClient';
+import type { Digest, DropResponse } from './types';
+import { NotAuthenticatedError, SiteCreateError } from './errors';
+
+export interface AuthenticatedDropClientConfig {
+  /**
+   * API base for every call. Requests go straight to `api.netlify.com`, whose
+   * `/api/*` CORS policy allows any origin, rather than through a consumer's
+   * access-control rewrite — that proxy allowlists paths per origin, and site
+   * and deploy creation are not on the list for netlify.com (they 400 with
+   * `x-debug: request origin not allowed to call endpoint`).
+   */
+  apiBase?: string;
+  /**
+   * Mint a short-lived bearer token authorizing the calls. On netlify.com this
+   * is `GET /access-control/generate-access-control-token`, whose
+   * `accessControlToken` the API decrypts back into the user's access token.
+   * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
+   */
+  getUploadToken: () => Promise<string | null>;
+  /** Create the site in this account. Omit to use the user's default account. */
+  accountSlug?: string;
+  /** How often to re-read the deploy while waiting. Default 1s. */
+  pollIntervalMs?: number;
+  /** How long to wait before giving up on the deploy. Default 10 minutes. */
+  timeoutMs?: number;
+}
+
+// Same defaults as AuthenticatedBuildClient — the ~15 lines shared with it
+// (constants + site create) are deliberately duplicated rather than extracted,
+// to avoid churn on the in-review build-client branch. Worth unifying once both
+// have landed.
+const API_BASE = 'https://api.netlify.com/api/v1';
+const POLL_INTERVAL_MS = 1000;
+const TIMEOUT_MS = 10 * 60 * 1000;
+
+/** Deploy states that end the wait — `ready` succeeds, the rest are failures. */
+const TERMINAL_STATES = new Set(['ready', 'error', 'rejected']);
+
+interface DeployState {
+  state?: string;
+  error_message?: string;
+}
+
+/** Response body of `POST /sites/{id}/deploys` — the slice the drop flow needs. */
+interface SiteDeployResponse {
+  /** deploy id (BSON) */
+  id: string;
+  /** SHAs the backend does NOT yet have — only these get uploaded */
+  required?: string[];
+}
+
+/**
+ * Authenticated drop client for logged-in visitors. Unlike `AnonymousDropClient`
+ * — which creates an account-less site the visitor must later claim — this
+ * deploys straight into the visitor's account via the sites/deploys API,
+ * mirroring what app.netlify.com does for a logged-in drag-and-drop deploy.
+ * There is no claim step, so the caller should hand off to the site's dashboard
+ * page rather than the claim page.
+ *
+ * Every request goes direct to `api.netlify.com` with the short-lived bearer
+ * from `getUploadToken()`. Routing the JSON calls through a consumer's
+ * access-control rewrite instead (cookie session, no token in the browser)
+ * would be the tighter design, but that proxy allowlists paths per origin and
+ * site/deploy creation isn't allowed from netlify.com — it 400s before
+ * reaching the API. Revisit if that allowlist gains these paths.
+ *
+ * Error-mapping invariant: only pre-mutation failures — a null upload token, or
+ * a 401/403 creating the site — throw `NotAuthenticatedError`, which is the
+ * signal the drop flow may safely retry anonymously. Once the site exists, an
+ * auth failure throws a plain status-carrying error instead: falling back at
+ * that point would strand an empty site in the account *and* deploy a duplicate
+ * anonymously.
+ */
+export class AuthenticatedDropClient implements DropClient {
+  private apiBase: string;
+  private getUploadToken: () => Promise<string | null>;
+  private accountSlug?: string;
+  private pollIntervalMs: number;
+  private timeoutMs: number;
+
+  constructor({
+    apiBase = API_BASE,
+    getUploadToken,
+    accountSlug,
+    pollIntervalMs = POLL_INTERVAL_MS,
+    timeoutMs = TIMEOUT_MS,
+  }: AuthenticatedDropClientConfig) {
+    this.apiBase = apiBase;
+    this.getUploadToken = getUploadToken;
+    this.accountSlug = accountSlug;
+    this.pollIntervalMs = pollIntervalMs;
+    this.timeoutMs = timeoutMs;
+  }
+
+  /**
+   * The token here is the upload bearer, not a drop token — it authorizes every
+   * call this client makes. Minted once per deploy, before anything is created,
+   * so a missing session fails the whole attempt cleanly.
+   */
+  async getToken(): Promise<string> {
+    const token = await this.getUploadToken();
+    if (!token) throw new NotAuthenticatedError();
+    return token;
+  }
+
+  /**
+   * Two calls: create the site in the visitor's account, then the deploy on it.
+   * Mapped into the anonymous `DropResponse` shape so `deployFiles` runs
+   * unchanged over either client.
+   */
+  async createDeploy(files: Digest, token: string): Promise<DropResponse> {
+    const path = this.accountSlug ? `/${this.accountSlug}/sites` : '/sites';
+    const siteRes = await fetch(`${this.apiBase}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ created_via: 'drop' }),
+    });
+    // A logged-out visitor 401s here, before anything is created — the one
+    // point an anonymous fallback is still safe (see the class doc).
+    if (siteRes.status === 401 || siteRes.status === 403) throw new NotAuthenticatedError();
+    if (!siteRes.ok) throw new SiteCreateError(siteRes.status);
+    const site: BuildSite = await siteRes.json();
+
+    const deployRes = await fetch(`${this.apiBase}/sites/${site.id}/deploys`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ files, deploy_source: 'drop' }),
+    });
+    if (!deployRes.ok) throw apiError('deploy create', deployRes.status);
+    const deploy: SiteDeployResponse = await deployRes.json();
+
+    return {
+      id: site.id,
+      deploy_id: deploy.id,
+      subdomain: site.name,
+      required: deploy.required ?? [],
+    };
+  }
+
+  async uploadFile(
+    deployId: string,
+    path: string,
+    content: ArrayBuffer,
+    token: string
+  ): Promise<void> {
+    // PUT (not POST) so paths with "&" etc. work.
+    const res = await fetch(`${this.apiBase}/deploys/${deployId}/files${path}`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/octet-stream', Authorization: `Bearer ${token}` },
+      body: content,
+    });
+    if (!res.ok) throw apiError(`upload ${path}`, res.status);
+  }
+
+  /**
+   * Poll until the deploy settles: resolve on `ready`, throw on
+   * `error`/`rejected`, throw on timeout. Reuses the bearer minted at the start
+   * of the deploy, so a deploy that outlives the token's TTL will start seeing
+   * 401s here — those are ignored like any other non-ok read and the loop runs
+   * to its timeout rather than failing fast. Acceptable while static deploys
+   * finish in seconds; re-mint per poll if that stops being true.
+   */
+  async waitUntilReady(deploy: DropResponse, token: string): Promise<void> {
+    const deadline = this.timeoutMs / this.pollIntervalMs;
+    for (let i = 0; i < deadline; i++) {
+      const res = await fetch(`${this.apiBase}/deploys/${deploy.deploy_id}`, {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      if (res.ok) {
+        const state: DeployState = await res.json();
+        if (state.state && TERMINAL_STATES.has(state.state)) {
+          if (state.state === 'ready') return;
+          throw new Error(
+            state.error_message ? `deploy failed: ${state.error_message}` : 'deploy failed'
+          );
+        }
+      }
+      await new Promise(r => setTimeout(r, this.pollIntervalMs));
+    }
+    // Same message the anonymous client uses, so humanizeDropError maps it.
+    throw new Error('Deploy did not become ready in time');
+  }
+}

package/packages/components/preact/DropZone/drop-core/buildClient.ts

@@ -0,0 +1,187 @@
+import {
+  BuildCreateError,
+  BuildFailedError,
+  BuildTimeoutError,
+  NotAuthenticatedError,
+  SiteCreateError,
+} from './errors';
+
+/** The subset of a Netlify Site the drop flow needs to redirect and report. */
+export interface BuildSite {
+  /** site id (UUID) */
+  id: string;
+  /** the *.netlify.app subdomain, also the app's URL segment */
+  name: string;
+  /** https://<name>.netlify.app */
+  ssl_url?: string;
+  url?: string;
+}
+
+/** The subset of a Netlify Build returned by `POST /sites/{id}/builds`. */
+export interface BuildResponse {
+  /** build id */
+  id: string;
+  /** the deploy the build produces — present as soon as the build is enqueued */
+  deploy_id?: string;
+}
+
+export interface BuildClient {
+  createSite(): Promise<BuildSite>;
+  createBuildFromZip(siteId: string, zip: File): Promise<BuildResponse>;
+  waitUntilBuildReady(build: BuildResponse): Promise<void>;
+}
+
+export interface AuthenticatedBuildClientConfig {
+  /**
+   * API base for every call. Requests go straight to `api.netlify.com`, whose
+   * `/api/*` CORS policy allows any origin, rather than through a consumer's
+   * access-control rewrite — that proxy allowlists paths per origin, and site
+   * creation and deploy reads are not on the list for netlify.com (they 400
+   * with `x-debug: request origin not allowed to call endpoint`). The zip
+   * upload could not use that proxy regardless: it runs in a Lambda with a
+   * ~6MB request body limit.
+   */
+  apiBase?: string;
+  /**
+   * Mint a short-lived bearer token authorizing the calls. On netlify.com this
+   * is `GET /access-control/generate-access-control-token`, whose
+   * `accessControlToken` the API decrypts back into the user's access token.
+   * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
+   */
+  getUploadToken: () => Promise<string | null>;
+  /** Create the site in this account. Omit to use the user's default account. */
+  accountSlug?: string;
+  /** Title recorded against the build. */
+  title?: string;
+  /** How often to re-read the deploy while waiting. Default 1s. */
+  pollIntervalMs?: number;
+  /** How long to wait before giving up on the build. Default 10 minutes. */
+  timeoutMs?: number;
+}
+
+const API_BASE = 'https://api.netlify.com/api/v1';
+const POLL_INTERVAL_MS = 1000;
+const TIMEOUT_MS = 10 * 60 * 1000;
+
+/** Deploy states that end the wait — `ready` succeeds, the rest are failures. */
+const TERMINAL_STATES = new Set(['ready', 'error', 'rejected']);
+
+interface DeployState {
+  state?: string;
+  error_message?: string;
+}
+
+/**
+ * Authenticated drop client for projects that need a build. Unlike
+ * `AnonymousDropClient` — which creates an account-less static site and can only
+ * upload pre-built files — this creates a real site in the user's account and
+ * hands buildbot a source archive to build, mirroring what app.netlify.com does
+ * for a drag-and-drop build.
+ *
+ * Requests split across two hosts by necessity: JSON calls go through the
+ * consumer's access-control proxy (cookie session, no token handling in the
+ * browser), while the zip upload goes direct to `api.netlify.com` with a
+ * short-lived bearer token because the proxy can't carry a body that large.
+ */
+export class AuthenticatedBuildClient implements BuildClient {
+  private apiBase: string;
+  private getUploadToken: () => Promise<string | null>;
+  private accountSlug?: string;
+  private title: string;
+  private pollIntervalMs: number;
+  private timeoutMs: number;
+
+  constructor({
+    apiBase = API_BASE,
+    getUploadToken,
+    accountSlug,
+    title = 'Build from drop deployment',
+    pollIntervalMs = POLL_INTERVAL_MS,
+    timeoutMs = TIMEOUT_MS,
+  }: AuthenticatedBuildClientConfig) {
+    this.apiBase = apiBase;
+    this.getUploadToken = getUploadToken;
+    this.accountSlug = accountSlug;
+    this.title = title;
+    this.pollIntervalMs = pollIntervalMs;
+    this.timeoutMs = timeoutMs;
+  }
+
+  /**
+   * Create the site the build deploys into. Authorized by the bearer token;
+   * without an account slug the API picks the user's default account.
+   */
+  async createSite(): Promise<BuildSite> {
+    const token = await this.getUploadToken();
+    if (!token) throw new NotAuthenticatedError();
+
+    const path = this.accountSlug ? `/${this.accountSlug}/sites` : '/sites';
+    const res = await fetch(`${this.apiBase}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ created_via: 'drop' }),
+    });
+    // A logged-out visitor gets a 401 here rather than at the token step, since
+    // this is the first call that needs the session.
+    if (res.status === 401 || res.status === 403) throw new NotAuthenticatedError();
+    if (!res.ok) throw new SiteCreateError(res.status);
+    return res.json();
+  }
+
+  /**
+   * Upload the source archive and enqueue a build. Direct to `api.netlify.com`
+   * (see the note on `apiBase`), authorized by a freshly minted bearer token.
+   * `Content-Type` is left unset on purpose so the browser adds the multipart
+   * boundary itself.
+   */
+  async createBuildFromZip(siteId: string, zip: File): Promise<BuildResponse> {
+    const token = await this.getUploadToken();
+    if (!token) throw new NotAuthenticatedError();
+
+    const body = new FormData();
+    body.append('zip', zip);
+    body.append('title', this.title);
+
+    const res = await fetch(`${this.apiBase}/sites/${siteId}/builds`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}` },
+      body,
+    });
+    if (res.status === 401 || res.status === 403) throw new NotAuthenticatedError();
+    if (!res.ok) throw new BuildCreateError(res.status);
+    return res.json();
+  }
+
+  /**
+   * Poll the build's deploy until it settles, mirroring
+   * `AnonymousDropClient.waitUntilReady` — resolve on `ready`, throw on
+   * `error`/`rejected`, throw on timeout. A build that hasn't been given a
+   * deploy id yet has nothing pollable, so it resolves immediately and the
+   * caller falls back to the site page.
+   *
+   * Optional in the drop flow, and off by default: a build takes minutes, which
+   * can outlive the bearer token minted for it. Each poll re-mints so a long
+   * build keeps reading; a token that can't be minted any more ends the wait as
+   * a timeout rather than a false failure.
+   */
+  async waitUntilBuildReady(build: BuildResponse): Promise<void> {
+    if (!build.deploy_id) return;
+
+    const deadline = this.timeoutMs / this.pollIntervalMs;
+    for (let i = 0; i < deadline; i++) {
+      const token = await this.getUploadToken();
+      const res = await fetch(`${this.apiBase}/deploys/${build.deploy_id}`, {
+        headers: token ? { Authorization: `Bearer ${token}` } : {},
+      });
+      if (res.ok) {
+        const deploy: DeployState = await res.json();
+        if (deploy.state && TERMINAL_STATES.has(deploy.state)) {
+          if (deploy.state === 'ready') return;
+          throw new BuildFailedError(deploy.error_message);
+        }
+      }
+      await new Promise(r => setTimeout(r, this.pollIntervalMs));
+    }
+    throw new BuildTimeoutError();
+  }
+}

package/packages/components/preact/DropZone/drop-core/client.ts

@@ -1,7 +1,7 @@
 import type { DropResponse, Digest } from './types';
 
 /** A normal Error with the response's HTTP status attached, so callers can branch on it directly. */
-function apiError(action: string, status: number): Error & { status: number } {
+export function apiError(action: string, status: number): Error & { status: number } {
   return Object.assign(new Error(`${action} failed: ${status}`), { status });
 }
 

package/packages/components/preact/DropZone/drop-core/deploy.ts

@@ -1,6 +1,9 @@
 import { getDigest } from './digest';
+import type { BuildClient, BuildResponse, BuildSite } from './buildClient';
 import type { DropClient } from './client';
+import type { InferredBuildSettings } from './detectBuild';
 import type { DeployProgress, DeployResult, ProcessedFile } from './types';
+import { zipFiles } from './zip';
 
 const MAX_CONCURRENT_UPLOADS = 5;
 
@@ -55,3 +58,65 @@ export async function deployFiles(
   onProgress?.({ phase: 'ready' });
   return { deploy, token, url: `https://${deploy.subdomain}.netlify.app` };
 }
+
+export interface BuildDeployResult {
+  /** The site created for this build. */
+  site: BuildSite;
+  /** The enqueued build; `deploy_id` is what the app's deploy page keys off. */
+  build: BuildResponse;
+  /** Settings synthesised into the uploaded `netlify.toml`, or null if none were. */
+  buildSettings: InferredBuildSettings | null;
+  /** The site's live URL — only serves content once the build finishes. */
+  url: string;
+}
+
+export interface BuildDeployOptions extends DeployOptions {
+  /**
+   * Poll until the build finishes instead of returning as soon as it's enqueued.
+   * Off by default: a build takes minutes, so the useful hand-off is usually the
+   * app's deploy page with its live logs, not a spinner. Turn it on when the
+   * caller needs to know the outcome — only then can a `BuildFailedError` reach
+   * it with the build's own error message.
+   */
+  waitForBuild?: boolean;
+}
+
+/**
+ * The build counterpart to `deployFiles`: zip the drop, create a site in the
+ * user's account, and hand the archive to buildbot. Requires an authenticated
+ * client — builds have no anonymous equivalent.
+ *
+ * Site creation deliberately happens *after* zipping, so a zip that fails
+ * doesn't leave an empty site behind in the user's account.
+ */
+export async function deployBuild(
+  client: BuildClient,
+  files: ProcessedFile[],
+  opts: BuildDeployOptions = {}
+): Promise<BuildDeployResult> {
+  if (!files.length) throw new Error('No files to deploy');
+  const { onProgress, waitForBuild = false } = opts;
+
+  onProgress?.({ phase: 'zipping' });
+  const { file: zip, buildSettings } = await zipFiles(files);
+
+  onProgress?.({ phase: 'creating' });
+  const site = await client.createSite();
+
+  // No byte-level progress to report: this is one multipart request, and
+  // `fetch` exposes no upload progress. The phase still flips so the UI can say
+  // "uploading" rather than sitting on "creating" for the length of the upload.
+  onProgress?.({ phase: 'uploading' });
+  const build = await client.createBuildFromZip(site.id, zip);
+
+  onProgress?.({ phase: 'building' });
+  if (waitForBuild) await client.waitUntilBuildReady(build);
+
+  onProgress?.({ phase: 'ready' });
+  return {
+    site,
+    build,
+    buildSettings,
+    url: site.ssl_url || site.url || `https://${site.name}.netlify.app`,
+  };
+}

package/packages/components/preact/DropZone/drop-core/detectBuild.ts

@@ -18,28 +18,35 @@ export interface BuildDetection {
  * Dependencies whose presence implies a build even without an explicit `build`
  * script (e.g. a framework wired through its own CLI). Not exhaustive — the
  * `build` script check below catches the common case; this is the backstop.
+ *
+ * The value is the framework's default publish directory, or `null` where that
+ * directory isn't a fixed string we can state with confidence — Nuxt, SvelteKit,
+ * Remix and Angular all resolve it from an adapter or project name. `null` means
+ * "a build is required, but don't guess a publish directory": see
+ * `inferBuildSettings`, which only synthesises a `netlify.toml` when it knows
+ * both halves of the answer.
  */
-const FRAMEWORK_DEPENDENCIES = new Set([
-  'astro',
-  'next',
-  'nuxt',
-  'gatsby',
-  'vite',
-  'react-scripts',
-  'parcel',
-  'expo',
-  'gridsome',
-  'vuepress',
-  'hexo',
-  '@remix-run/dev',
-  '@sveltejs/kit',
-  '@angular/cli',
-  '@vue/cli-service',
-  '@11ty/eleventy',
-  '@docusaurus/core',
-  '@builder.io/qwik',
-  '@analogjs/platform',
-  '@solidjs/start',
+const FRAMEWORK_DEPENDENCIES = new Map<string, string | null>([
+  ['astro', 'dist'],
+  ['next', '.next'],
+  ['nuxt', null],
+  ['gatsby', 'public'],
+  ['vite', 'dist'],
+  ['react-scripts', 'build'],
+  ['parcel', 'dist'],
+  ['expo', 'dist'],
+  ['gridsome', 'dist'],
+  ['vuepress', null],
+  ['hexo', 'public'],
+  ['@remix-run/dev', null],
+  ['@sveltejs/kit', null],
+  ['@angular/cli', null],
+  ['@vue/cli-service', 'dist'],
+  ['@11ty/eleventy', '_site'],
+  ['@docusaurus/core', 'build'],
+  ['@builder.io/qwik', 'dist'],
+  ['@analogjs/platform', null],
+  ['@solidjs/start', null],
 ]);
 
 /**
@@ -71,16 +78,21 @@ function hasBuildScript(pkg: Record<string, unknown>): boolean {
   return typeof build === 'string' && build.trim().length > 0;
 }
 
-/** True if any dependency (prod or dev) is a known build-requiring framework. */
-function hasFrameworkDependency(pkg: Record<string, unknown>): boolean {
+/** The first known build-requiring framework among the deps (prod or dev), if any. */
+function findFrameworkDependency(pkg: Record<string, unknown>): string | null {
   for (const key of ['dependencies', 'devDependencies'] as const) {
     const deps = pkg[key];
     if (!deps || typeof deps !== 'object') continue;
     for (const name of Object.keys(deps)) {
-      if (FRAMEWORK_DEPENDENCIES.has(name)) return true;
+      if (FRAMEWORK_DEPENDENCIES.has(name)) return name;
     }
   }
-  return false;
+  return null;
+}
+
+/** True if any dependency (prod or dev) is a known build-requiring framework. */
+function hasFrameworkDependency(pkg: Record<string, unknown>): boolean {
+  return findFrameworkDependency(pkg) !== null;
 }
 
 /**
@@ -102,23 +114,13 @@ export function detectBuild(files: ProcessedFile[]): BuildDetection {
     return { buildRequired: true, reason: 'netlify-toml-build' };
   }
 
-  const pkg = rootFile(files, '/package.json');
-  if (pkg) {
-    let parsed: Record<string, unknown> | null = null;
-    try {
-      parsed = JSON.parse(text(pkg)) as Record<string, unknown>;
-    } catch {
-      // A malformed package.json isn't a reliable build signal on its own —
-      // fall through and let the other heuristics decide.
-      parsed = null;
+  const parsed = readPackageJson(files);
+  if (parsed) {
+    if (hasBuildScript(parsed)) {
+      return { buildRequired: true, reason: 'package-json-build-script' };
     }
-    if (parsed) {
-      if (hasBuildScript(parsed)) {
-        return { buildRequired: true, reason: 'package-json-build-script' };
-      }
-      if (hasFrameworkDependency(parsed)) {
-        return { buildRequired: true, reason: 'framework-dependency' };
-      }
+    if (hasFrameworkDependency(parsed)) {
+      return { buildRequired: true, reason: 'framework-dependency' };
     }
   }
 
@@ -128,3 +130,85 @@ export function detectBuild(files: ProcessedFile[]): BuildDetection {
 
   return { buildRequired: false, reason: null };
 }
+
+/** Parse the root `package.json`, or null when it's absent or malformed. */
+function readPackageJson(files: ProcessedFile[]): Record<string, unknown> | null {
+  const pkg = rootFile(files, '/package.json');
+  if (!pkg) return null;
+  try {
+    return JSON.parse(text(pkg)) as Record<string, unknown>;
+  } catch {
+    // A malformed package.json isn't a reliable build signal on its own —
+    // callers fall through and let the other heuristics decide.
+    return null;
+  }
+}
+
+// --- build settings for the synthesised netlify.toml ------------------------
+
+/** Build settings confident enough to write into a `netlify.toml` for buildbot. */
+export interface InferredBuildSettings {
+  /** Build command, e.g. `"npm run build"`. */
+  command: string;
+  /** Publish directory relative to the deploy root, no leading slash, e.g. `"dist"`. */
+  publish: string;
+  /** The dependency the settings were inferred from, e.g. `"astro"`. */
+  framework: string;
+}
+
+/** Lockfile at the deploy root → the package manager that wrote it. */
+const LOCKFILE_PACKAGE_MANAGERS: ReadonlyArray<readonly [string, string]> = [
+  ['/pnpm-lock.yaml', 'pnpm'],
+  ['/yarn.lock', 'yarn'],
+  ['/bun.lockb', 'bun'],
+  ['/bun.lock', 'bun'],
+  ['/package-lock.json', 'npm'],
+];
+
+/**
+ * A bare `[build]` table header at the start of a line. Stricter than
+ * `NETLIFY_TOML_BUILD_SECTION` on purpose: a config with only
+ * `[build.environment]` carries no command or publish directory, so it still
+ * needs a `[build]` table synthesised. (TOML permits defining a super-table
+ * after its sub-tables, so appending one is valid.)
+ */
+const NETLIFY_TOML_BUILD_TABLE = /^\s*\[build\]/m;
+
+function detectPackageManager(files: ProcessedFile[]): string {
+  for (const [path, manager] of LOCKFILE_PACKAGE_MANAGERS) {
+    if (rootFile(files, path)) return manager;
+  }
+  return 'npm';
+}
+
+/**
+ * Infer the build command and publish directory for a build-required drop, so
+ * `zipFiles` can write them into a `netlify.toml` that buildbot reads.
+ *
+ * Deliberately conservative: it returns settings **only** when both halves are
+ * known — a `build` script (which gives the command) and a recognised framework
+ * with a fixed default publish directory (which gives the output). Anything else
+ * returns `null`, leaving the zip without a synthesised `[build]` table so
+ * buildbot's own framework detection resolves the settings instead. That matters
+ * because a `[build]` table with a command but no `publish` makes buildbot
+ * publish the deploy root — shipping the project's *source* rather than its
+ * built output, which is worse than not guessing at all.
+ *
+ * Returns `null` too when the drop already declares a `[build]` table: the
+ * author's own config always wins.
+ */
+export function inferBuildSettings(files: ProcessedFile[]): InferredBuildSettings | null {
+  const toml = rootFile(files, '/netlify.toml');
+  if (toml && NETLIFY_TOML_BUILD_TABLE.test(text(toml))) return null;
+
+  const pkg = readPackageJson(files);
+  if (!pkg || !hasBuildScript(pkg)) return null;
+
+  const framework = findFrameworkDependency(pkg);
+  if (!framework) return null;
+
+  const publish = FRAMEWORK_DEPENDENCIES.get(framework);
+  if (!publish) return null;
+
+  return { command: `${detectPackageManager(files)} run build`, publish, framework };
+}